CVE-2023-4091

2023-11-0308:15:08

Google

osv.dev

cve-2023-4091

samba

smb clients

file truncation

read-only permissions

vfs module

acl_xattr

smb protocol

overwrite create

file system permissions

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

7 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

52.0%

JSON

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module “acl_xattr” is configured with “acl_xattr:ignore system acls = yes”. The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba’s permissions.

CPENameOperatorVersion
sambaeqtalloc-2.1.5
sambaeqsamba-4.0.0alpha19
sambaeq4.11.2-r0
sambaeq3.6.1-r0
sambaeqtalloc-2.1.8
sambaeq4.18.4-r0
sambaeq4.18.6-r0
sambaeq4.7.1-r0
sambaeqldb-1.1.2
sambaeqtevent-0.9.15

Name	Operator	Version
samba	eq	talloc-2.1.5
samba	eq	samba-4.0.0alpha19
samba	eq	4.11.2-r0
samba	eq	3.6.1-r0
samba	eq	talloc-2.1.8
samba	eq	4.18.4-r0
samba	eq	4.18.6-r0
samba	eq	4.7.1-r0
samba	eq	ldb-1.1.2
samba	eq	tevent-0.9.15